# Security Policy

## Supported Versions

Security fixes are supported for the current `main` branch and the latest
published GitHub release. Older tags remain available for archival
reproducibility, but they do not receive backported security patches unless a
maintainer explicitly publishes a security advisory for that release line.

## Reporting a Vulnerability

We take the security of this public research-project template seriously. If you
believe you have found a security vulnerability, report it privately as
described below.

### How to Report

**Please do not report security vulnerabilities through public GitHub issues.**

Use GitHub's private vulnerability reporting:
[Report a vulnerability](https://github.com/docxology/template/security/advisories/new).
If private reporting is unavailable, contact the maintainer through the
[`docxology`](https://github.com/docxology) GitHub profile.

You can expect an acknowledgement within a few days. Include a safe contact
route in the report if you need follow-up outside the GitHub advisory thread.

### 📋 **What to Include**

Please include the following information in your report:

- **Type of issue** (buffer overflow, SQL injection, cross-site scripting, etc.)
- **Full paths** of source file(s) related to the vulnerability
- **The number of line(s)** of code where the vulnerability can be observed
- **A description** of the vulnerability
- **A description** of how the vulnerability can be exploited
- **Proof-of-concept** or exploit code (if possible)
- **Impact** of the issue (data loss, system compromise, etc.)

### 🔍 **What Happens Next**

1. **Acknowledgment**: You will receive an acknowledgment within a few days
2. **Investigation**: Our security team will investigate the report
3. **Updates**: You will receive updates on the progress
4. **Resolution**: Once resolved, we will:
   - Release a security update
   - Credit you in the security advisory (unless you prefer to remain anonymous)
   - Update the changelog

## Security Best Practices

### For Template Users

- **Keep dependencies updated** - Regularly update your project dependencies
- **Review generated code** - Always review code generated by scripts
- **Validate inputs** - Ensure all user inputs are properly validated
- **Use secure defaults** - Don't override security-related default settings
- **Monitor for updates** - Watch for security updates to this template

### For Contributors

- **Follow secure coding practices** - Use established security patterns
- **Validate all inputs** - Never trust user input without validation
- **Use secure defaults** - Implement secure-by-default configurations
- **Test security scenarios** - Include security-focused tests
- **Review dependencies** - Regularly review and update dependencies

## Security Updates

### Update Schedule

- **Critical vulnerabilities**: Immediate release (within 24 hours)
- **High severity**: Within 72 hours
- **Medium severity**: Within 1 week
- **Low severity**: Within 1 month

### Notification Process

- **Security advisories** will be published on GitHub
- **Release notes** will include security-related changes
- **Email notifications** for critical vulnerabilities (if you've reported issues)

## Security Acknowledgements

We gratefully acknowledge security researchers who have responsibly disclosed vulnerabilities:

- Researchers are credited in GitHub Security Advisories or release notes when
  they ask to be named and coordinated disclosure allows publication.

## Additional Resources

- **OWASP Top 10**: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/)
- **Python Security**: [https://python-security.readthedocs.io/](https://python-security.readthedocs.io/)
- **GitHub Security**: [https://docs.github.com/en/code-security](https://docs.github.com/en/code-security)

## Maintainer Response

The public maintainer account is
[`docxology`](https://github.com/docxology). Security reports are triaged
through GitHub private vulnerability reporting, with release notes and security
advisories used for public disclosure after a fix is available.

For project security practices and development guidelines, see **[`contributing.md`](contributing.md)** and **[`code-of-conduct.md`](code-of-conduct.md)**.

---

**Thank you for helping keep this template secure.**